[CVE-2025-47944] `@nestjs/platform-express` 10.x is using a vulnerable version of `multer@1.4.4-lts.1`

[JoshVee]

Is there an existing issue for this?

• I have searched the existing issues

Current behavior

Snyk is currently reporting CVE-2025-47944 \ SNYK-JS-MULTER-10185673 for @nestjs/platform-express due to the multer@1.4.4-lts.1 dependency.

multer needs to be bumped to 2.0.0 in NestJS 10.x

https://www.cve.org/CVERecord?id=CVE-2025-47944

Issues with no direct upgrade or patch:
  ✗ Uncaught Exception [High Severity][https://security.snyk.io/vuln/SNYK-JS-MULTER-10185673] in multer@1.4.4-lts.1
    introduced by @nestjs/platform-express@10.4.17 > multer@1.4.4-lts.1
  This issue was fixed in versions: 2.0.0
  ✗ Missing Release of Memory after Effective Lifetime [High Severity][https://security.snyk.io/vuln/SNYK-JS-MULTER-10185675] in multer@1.4.4-lts.1
    introduced by @nestjs/platform-express@10.4.17 > multer@1.4.4-lts.1
  This issue was fixed in versions: 2.0.0

Minimum reproduction code

GHSA-4pg4-qvpc-4q3h

Steps to reproduce

No response

Expected behavior

Upgrade Multer to v2.0.0

Package

• I don't know. Or some 3rd-party package
• @nestjs/common
• @nestjs/core
• @nestjs/microservices
• @nestjs/platform-express
• @nestjs/platform-fastify
• @nestjs/platform-socket.io
• @nestjs/platform-ws
• @nestjs/testing
• @nestjs/websockets
• Other (see below)

Other package

No response

NestJS version

10.4.17

Packages versions

"@nestjs/core": "^10.4.17",
"@nestjs/platform-express": "^10.4.17",

Node.js version

No response

In which operating systems have you tested?

• macOS
• Windows
• Linux

Other

No response

[un4ckn0wl3z]

📌

[lucas-implanta]

Here I tried manually overriding to multer@1.4.5-lts.1, got success with this version, but not quite with 2.0.0 (strangely, with 1.4.5-lts.1, npm audit doesn't bother about vulnerabilities, perhaps not mapped yet, despite it's stated that it's fixed only on 2.0.0)

If you want to just pass some kind of pipeline npm audit validation that demands you to have non vulnerable packages in non dev dependencies, you can try this temporarily.

Running npm list multer with overrides in root package.json inside a monorepo:

@foo/bar
└─┬ foo_bar@0.0.1 -> ./foo/bar_back
  └─┬ @nestjs/platform-express@10.4.17
    └── multer@1.4.5-lts.1 overridden

Still, would be good to update directly to 2.0.0 🙏

[lenzch]

The latest version is affect as well:

└─┬ @nestjs/platform-express@11.1.1
  └── multer@1.4.5-lts.2

In addition to CVE-2025-47944 also CVE-2025-47935 is popping up now.

[SchroederSteffen]

I would expect that apps that don't use the related features like the various file interceptors are not affected by this vulnerability.
Could you please confirm?

[mpeteffi]

In the meantime, you can override the version to 2.0.0 like this:

package.json

{
  // ...
  "overrides": {
    "multer": "2.0.0"
  }
}

This should help as a temporary workaround.

[tonymathew17]

In the meantime, you can override the version to 2.0.0 like this:

package.json

{
// ...
"overrides": {
"multer": "2.0.0"
}
}
This should help as a temporary workaround.

@mpeteffi Is it safe to do this? Any breaking change?

[tonymathew17]

In the meantime, you can override the version to 2.0.0 like this:
package.json
{
// ...
"overrides": {
"multer": "2.0.0"
}
}
This should help as a temporary workaround.

@mpeteffi Is it safe to do this? Any breaking change?

Also this doesn't actually update the dependency. After doing this, when I do npm ls multer, I still see the old version:
└─┬ @nestjs/platform-express@11.1.1
└── multer@1.4.5-lts.2

[abennouna]

Also this doesn't actually update the dependency. After doing this, when I do npm ls multer, I still see the old version:

I did

    "@nestjs/platform-express": {
      "multer": "^2.0.0"
    },

and when I npm ls multer I get:

└─┬ @nestjs/platform-express@11.1.1 overridden
  └── multer@2.0.0 overridden

[mpeteffi]

@mpeteffi Is it safe to do this? Any breaking change?

I believe so. I'm following PR #15159, where the platform-express dependency was updated from 1.4.5-lts.2 to 2.0.0 without any additional changes required. However, it's always recommended to check for relevant changes in the source repository.

Spoiler: the main breaking change is that the minimum supported Node.js version is now 10.16.0

Also this doesn't actually update the dependency. After doing this, when I do npm ls multer, I still see the old version:
└─┬ @nestjs/platform-express@11.1.1
└── multer@1.4.5-lts.2

It does. After installing, npm ls multer should looks like this:

└─┬ @nestjs/platform-express@11.1.1
  └── multer@2.0.0 overridden